Robust Statistical Methods for Securing Wireless Localization in Sensor Networks (IPSN ’05)

1. Robust Statistical Methods for Securing Wireless Localization in Sensor Networks (IPSN ’05) Zang Li, Wade Trappe Yanyong Zhang, Badri Nath Rutgers University Presented by Seung-Min Jung

2. Contents • Introduction • Localization Specific Attacks • Robust Localization Algorithms • Robust Methods • Triangulation & Experiments • RF-Based Fingerprinting & Experiments • Conclusions

3. Introductions(1) • Many sensor applications need the location of wireless devices • Localization infrastructure will become the target of malicious attacks • Localization-specific threats that cannot be address through traditional security services • Need for localization algorithm that are robust to corrupted measurements

4. Introductions(2) • What is the purpose of this paper? • To examine the problem of secure localization • To provide localization-specific, attack-tolerant mechanisms • Basic Idea throughout the paper • To live with bad nodes rather than eliminate the all possible bad nodes • Uniqueness of this paper • Approach of the paper • Robust Statistical Methods for Localization

5. Localization Attacks(1) • Primarily non-cryptographic attacks • Bypass the conventional security countermeasures • c.f.) Cryptographic attack example: Sybil Attack • There are many solutions • Attacks classification by methods • Time of Flight • Signal Strength • Angle of Arrival • Region Inclusion • Hop Count • Neighbor Location

6. Localization Attacks(2)

7. Localization Attacks(3) • Hop-Count Attack Example

8. Robust Localization(1) • Approach: Living with Bad Guys • There is no silver bullet for removing all threats to wireless localization • Make use of the redundancy in the deployment of the localization infra. to provide stability to contaminated measurements

9. Robust Localization(2) • Strategy • Focused localization scheme • Triangulation • RF-Based fingerprinting • Make use of the (statistical) median • as a resilient estimate of the average of aggregated data • Estimate position from physical measurement • e.g.) Signal Strength, Hop Count • Robust statistical method & Less computation overhead

10. minimum is the wireless device location Robust Method for Triangulation • Find Device Location by Triangulation Anchor3 (x2,y2) d4 d3 Anchor4 (x2,y2) d2 Anchor2 (x2,y2) Wireless device (x0,y0) d1 Anchor1 (x1,y1)

11. Review(1) • Regression Analysis Simple Linear Regression Model: Minimize

12. Review(2) • Least Squares (LS) • Find θ that minimize J(θ) • Non-robustness to “outliers” N = total number of samples θ = the parameter to estimate (location) = corresponds to = corresponds to position (xi, yi) of the anchors

13. Review(3) • Residue • Least Median Squares (LMS) • Minimize the median of the residue squares • Robust to outliers • Tolerates up to 50% outliers(errors) • Computation expensive (for exact solution) • Efficient computation • Random subsets of samples to get several candidate • M: # of subset, n: # of samples

14. Robust Method for Triangulation(1) • Attacks • An intruder can disturb the distance d • Change hop count in DV-hop algorithm • A single perturbation can alter the result • Solution • Switch from least squares (LS) estimation to least median squares (LMS) when attacked

15. Robust Method for Triangulation(2) • LMS algorithm • Choose a number of M subsets of size n from the N Samples • Applying LS, find the estimate , j=1,…,M for each subset • Based on the median residual error assign a weight for each • weight=1 if the error is less than a threshold • weight=0 if otherwise • Compute weighted estimated

16. Robust Method for Triangulation(3) • Robust Localization with LMS • When no attack, LS method • When attack, LMS method

17. Robust Method for Triangulation(4) • How to choose n and M for LMS • Idea: at least one subset is “good” (no contamination) with probability: ε = contamination ratio => εN samples are outliers n=4 (3 would be minimum to decide a location) M=20 (depends on computational capabilities) P>=0.99 ε <=30%

18. Robust Method for Triangulation(5) • How to get a location estimate from samples efficiently Nonlinear LS: Linear LS:

19. Robust Method for Triangulation(6) • The comparison between linear LS and nonlinear LS • Use linear LS – reduces computational complexity • As # of samples increase, gap between linear LS and nonlinear LS decrease.

20. Robust Method for Triangulation(7) • Simulation Settings • The strength of the attack: • DV-hop algorithm • N = 30 anchor nodes • Resign: 500 x 500 m2

21. Robust Method for Triangulation(8) robust up to ε = 30% Performance: LS vs. LMS Impact of ε: LS vs. LMS

22. Robust Method for Triangulation(9) • Example linear regression demonstration Outlier data are distinctive Outlier data are close to inliers => LS performs better than LMS at low attacking strength

23. Robust Method for Triangulation(10) • An Efficient Switching LS-LMS • The variance indicates the distance between inliers and the outliers • If , apply LMS T=1.5 : estimated data variance : normal measurement noise level T : threshold

24. Robust Method for RF Fingerprinting(1) • Attacks • Corrupted signal strength at one base station • Insert an absorbing barrier between mobile host and base station (e.g. Microwave, Passenger) • Solution • Use a median-based distance metric • “nearest” neighbor: Minimize • RADAR system – in buildings • Multiple base stations

25. Robust Method for RF Fingerprinting(2) • How it works: • Setup phase: form a radio map with signal strengths(fingerprints) • a mobile host broadcasts to base stations • records are written in radio map on central base station and they have the format described below: • (x, y) : mobile position • : received signal strength at the i-th base station • Localization phase: nearest neighbor in signal space (NNSS) • send to central base station • search the radio map and find the best matching fingerprint on central base station Median approach: Euclidian distance :

26. Robust Method for RF Fingerprinting(3) Size: 45m X 25m, 6 base station are installed, 2 base station are attacked α: attacking strength α= 0.6 CDF of error distance for the NNSS Median of error distance

27. Conclusions • As increasing location-based services, localization infrastructure become more vulnerable • To secure localization, this paper • Enumerates a list of attacks that are unique to wireless localization algorithms • Provides robust statistical methods to make localization attack-tolerant • Based on triangulation and RF-based fingerprinting method • Use median approach more robust than the average to outliers

28. Supplements • Median

29. Supplements • Wormhole attack

30. Supplements